i had this brief conversation with Sipa:
"the R and S value are 256-bit values, which are at most 33 bytes when encoded in DER
then there is 6 bytes of DER headers
and bitcoin adds a 1 byte sighash to the end
so together 33+33+6+1 = 73 max
however, since the introduction of the low-s rule (which is just policy, not a consensus rule), S values are at most 255 bits, which encodes to at most 32 bytes, reducing the maximum to 72"
(I asked the clarifying question "aha, so when low-s is not applied, 33B R + 33B S + 6B headers + 1B sighash = 73 bytes" and he answered "right".)
